If you are an essential service operator, you report a serious cybersecurity incident to the National Security Authority through the unified cybersecurity information system. The early warning must be sent within 24 hours of detection, the notification with an initial assessment within 72 hours, and the final report no later than one month after the notification. Alongside reporting, you must address the incident, secure evidence, and report to the police or law enforcement authorities any criminal offence of which you credibly learn.
When a company’s systems go down, or it discovers that an outsider has reached its data, the first hours belong to the technicians. Act No. 69/2018 Coll. on Cybersecurity nevertheless requires an essential service operator to run legal steps with fixed deadlines alongside the technical response. The periods run from detection of the incident, not from the moment management has the full picture, so it is worth knowing the procedure before you need it.
What is reported and what is not
The duty falls on an essential service operator, that is, a party entered in the register maintained by the National Security Authority. Whether you are one is discussed in does NIS2 apply to us. A cybersecurity incident is any event threatening the availability, authenticity, integrity or confidentiality of data or services in networks and information systems. Only a serious incident, however, must be reported:
A serious cybersecurity incident means a large-scale cybersecurity incident and a cybersecurity incident which a) has caused or may cause serious disruption to the functioning of the essential service operator, or damage, other harm to property or loss of profit on a large scale […]
— Section 24(2) of Act No. 69/2018 Coll. (unofficial English translation)
An incident is also serious where it has affected, or may affect, other persons by causing them damage on a considerable scale. What matters is therefore the threat as well as damage that has already occurred. Alongside incidents, the Act also requires reporting of a significant cyber threat, a near miss and certain vulnerabilities in publicly accessible systems (Section 24(5)). Less serious events may be reported voluntarily.
Three reports, three fixed deadlines
Reporting under Section 24 of Act No. 69/2018 Coll. is submitted through the unified cybersecurity information system and has several parts. Within 24 hours of detection at the latest, you send an early warning, stating in particular whether the incident may have been caused by unlawful conduct and whether it may have cross-border effects. Within 72 hours of detection at the latest, a notification follows with an initial assessment of the incident, its seriousness and consequences. At the CSIRT unit’s request, updated information on developments must be supplied within a specified period. An operator in the financial sector to which Regulation (EU) 2022/2554 (DORA) applies discharges the reporting duty through the competent authority under that Regulation and within its deadlines (Section 24(8)).
No later than one month after the notification, a final report is submitted, describing the incident in detail together with its cause, the type of threat, the measures adopted and any cross-border effects (Section 24(3)(d)). If the incident is still ongoing at that time, the Act provides for further updates and an updated final report. Reporting does not replace the security measures, which you must continue to observe (Section 24(7)).
Alongside reporting: response, evidence and the police
The Act adds further duties to the reporting obligation (Section 19(6)). You must address the incident and cooperate with the authority and with the relevant central authority. During the incident, you must secure evidence so that it can be used in criminal proceedings, and if you credibly learn that a criminal offence has been committed, report it to the law enforcement authorities or the Police Force. Concerns about confidentiality are no obstacle to reporting: reporting incidents to the extent required by the Act does not breach the duty of confidentiality (Section 12(4)). If the incident were to prevent performance of a contract with a supplier, the operator must inform the supplier of the incident to the extent necessary (Section 19(4)).
If the incident has also affected personal data, the duties towards the Office for Personal Data Protection and the data subjects must be assessed separately. That is a different regime with its own rules and belongs to personal data protection.
The risks of missing a deadline
Failure to report a serious incident under Section 24(1) or (3) is an administrative offence for which the authority may impose a fine of up to EUR 7,000,000 or up to 1.4% of total worldwide annual turnover, whichever is higher (Section 31(2)(c)). For an operator of a critical essential service, the upper limit is EUR 10,000,000 or 2% of turnover (Section 31(3)). In setting the amount, the authority considers in particular the manner, duration and consequences of the breach.
What we recommend
Set the incident procedure up in advance: who assesses an incident as serious, who submits the report and who decides on reporting to the police. The Act also requires a contact person to be designated to receive and record reports (Section 20(4)(e)). We prepare the legal part, including internal procedures and the allocation of responsibilities, through our NIS2 and cybersecurity service. How to pass incident reporting down to IT suppliers is covered in NIS2 in supplier contracts.
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
